Home » PowerShell » lastlogon vs lastLogonTimestamp vs lastLogondate

lastlogon vs lastLogonTimestamp vs lastLogondate

The main difference between lastlogon and lastLogonTimeStamp is that lastlogon is updated on the Domain Controller after the user interactive logon while lastLogonTimeStamp is replicated to all Domain Controller in AD Forest, the default value is 14 days. The Lastlogon attribute is not replicated.

lastLogon vs lastLastonTimeStamp
lastLogon vs lastLogonTimestamp

While working with Active Directory objects, most of the time we have to query to get objects using datetime.

It’s much confusing to understand the difference between PowerShell lastLogon vs lastLogonTimestamp vs lastLogonDate attributes.

In the Active Directory, objects have lastlogon attributes like lastLogon, lastLogonTimestamp, lastLogondate.

In this article, I will try to explain the difference between PowerShell lastLogon vs lastLogonTimestamp vs lastLogondate attributes in Active Directory.

Let’s understand the last logon attributes in detail with examples using PowerShell.

PowerShell LastLogon

When a user logs on to the computer, the lastLogon attribute is updated in the domain controller.

LastLogon attribute updated in one DC after user interactive logon. It means the lastLogon attribute is not replicated.

LastLogon is very much helpful to identify a stale account or if you want to know which computers user has logged in or not.

When we run the command, it will return the recent logon timestamp of the domain controller where the user interactively logs on.

PowerShell lastLogon returns the most recent logon timestamp of ad user in number format which is not human-readable and requires converting it in date timestamp format.

To convert lastLogon number format to date timestamp,use

Get-ADUser -Identity Toms -Properties LastLogon | Select Name, @{Name='LastLogon';Expression={[DateTime]::FromFileTime($_.LastLogon)}}

In the above PowerShell script, Get-AdUser cmdlet get user properties specified by Identity parameter and pass output to second command.

@{Name=’LastLogon’;Expression={[DateTime]::FromFileTime($_.LastLogon)}} – convert lastlogon number format to date timestamp.

PowerShell lastLogonTimestamp

PowerShell lastLogonTimestamp attribute replicated to all domain controllers.

To prevent replication traffic every time a user logs on, its value is updated after a certain interval.

Active Directory calculates interval to update PowerShell lastLogonTimestamp value. The default update value is 14 days.

ms-DS-Logon-Time-Sync-Interval attribute define lastLogonTimestamp default value. if its value is not set, the default update value is 14 days.

PowerShell lastLogonTimestamp is replicated version of lastLogon.

It returns the last logon timestamp in number format which is not human-readable format and requires converting lastlogontimestamp to date.

PowerShell lastLogonDate

lastLogonDate attribute is a locally calculated value of the lastLogonTimestamp attribute in date format.

It’s very easy to write a date-time query with PowerShell lastLogonDate when we want to query get active directory objects or find active directory objects details using the lastLogonTimestamp attribute.

lastLogon vs lastLogonTimestamp vs lastLogonDate

Let’s understand the lastLogon vs lastLogonTimestamp vs lastLogonDate difference in active directory with an example.

Let’s consider an example to get active directory user detail using the Get-ADUser cmdlet.

When the user logs on to the computer in the active directory, it stores logon date timestamp information in attributes.

Get-AdUser -Identity johnp  -Properties * | Select DisplayName,LastLogon,LastLogonDate,LastLogonTimeStamp

In the above PowerShell script,

Get-ADUser cmdlet returns active directory user properties specified by the Identity parameter and passes the output to the second command.

The second command, Select Name, DistinguishedName, LastLogon, LastLogonTimestamp, and LastLogonDate from active directory user properties, and print it on the console.

Name              LastLogon LastLogonDate        LastLogonTimeStamp
----              --------- -------------        ------------------
John Paul 132722084016061942 7/29/2021 7:10:42 PM 132720594421239827

In the above output, LastLogon and LastLogonTimestamp attribute has non-human readable format output and requires conversion.

To convert lastlogontimestamp to date, use the [DateTime]:: FromFileName in the expression and provide lastlogontimestamp for conversion to date.

To convert lastlogon to date, use the [DateTime]:: FromFileName in the expression and provide lastlogontimestamp for conversion to date.

After applying datetime format conversion in PowerShell script convert lastlogontimestamp to date.

Get-AdUser -Identity johnp  -Properties * | Select DisplayName,@{Name='LastLogon';Expression={[DateTime]::FromFileTime($_.LastLogon)}},LastLogonDate,@{Name='LastLogonTimestamp';Expression={[DateTime]::FromFileTime($_.LastLogonTimestamp)}}

In the above script to convert lastlogontimestamp to date, get-aduser lastlogontimestamp format is number.

Using [DateTime]::FromFileTime($_.lastlogonTimestamp), it convert ad user lastlogontimestamp to datetime.

The output of above PowerShell script for lastLogon vs lastLogonTimestamp vs lastLogonDate.

lastLogon vs lastLogonTimestamp vs lastLogonDate
lastLogon vs lastLogonTimestamp vs lastLogonDate

In the above image, you can see the difference between lastLogon and lastLogonTimestamp attribute values.

lastLogonTimestamp attribute user logs on value not updated in the domain controller.

Active directory performs calculation to update datetime to prevent replication traffic.

As discussed above PowerShell LastLogonDate is the locally calculated value of lastLogonTimestamp in date-time format.

Cool Tip: How to get ad user not logged in x days in PowerShell!

Conclusion

I hope the above article on PowerShell lastLogon vs lastLogonTimestamp vs lastLogonDate attributes is helpful to you and deciding which attribute to use.

You can find more topics about PowerShell Active Directory commands and PowerShell basics on the ShellGeek home page.

Leave a Comment